The File Transfer Protocol (FTP) is one of the protocols in a Transmission Control Protocol/Internet Protocol (TCP/IP) group. The protocol, which is a basis of Internet file transmission, consists of a series of specification documents and aims to improve sharing of a file and enable a storage medium to transmit data to a user transparently, reliably and efficiently. Simply put, the FTP implements copying between two computers. A process of copying a file in a remote computer to a local computer is called “to download” the file while a process of copying a file in a local computer to a remote computer is called “to upload” the file. In the TCP/IP, the number of a standard command TCP port of the FTP is 21, and a Positive Port is 20. The FTP uses two TCP connections to transmit one file.
Generally, a control connection is established by a client and a server. The server opens a well-known port (21) for the FTP passively and waits for a connection to the client, while the client opens the TCP port 21 positively to create the connection. The control connection always waits for communication between the client and the server. The connection enables a command to transmit from the client to the server and to return a response from the server. Since the command is generally entered by a user, a service type of the IP for the control connection is to “maximally reduce a delay.” A data connection is established every time a file is transmitted between the client and the server. Since the connection is used for transmission, the IP serves for the data connection to “maximally improve the throughput.”
With the popularization of computer technologies and network technologies, more and more attention is being paid to the problem of network security, and it is of more and more importance to transmit a file safely and reliably based on the FTP. As a security mechanism for controlling FTP file transmission, a firewall has become the first choice of safe FTP transmission. A firewall aims to establish a barrier between a trusted network and a non-trusted network and implement a corresponding security strategy. A firewall applied in a network is an extremely effective network security means. Generally, a firewall is implemented by a packet filter technology.
The core of the packet filter technology is to define an Access Control List (ACL) rule to filter a data packet. For a data packet that needs to be forwarded, a packet filter firewall obtains header information (including a protocol number of a protocol of an upper layer carried on an IP layer, and a source address, a target address, a source port and a target port of the data packet and so on) of the data packet first, then compares the header information with the ACL rule set by a user, and processes the data packet (allowing the data packet to pass or discarding the data packet) according to a comparison result.
The advantages of the packet filter technology include that filtering only occurs on a network layer, and thus processing is rapid. Further, there is little impact on device performance especially in the conditions of moderate traffic, and a modest size of the configured ACL. Furthermore, the packet filter technology is implemented transparently for an application of an upper layer and a user, and it is unnecessary to install specific software on a user's host. Although the packet filter technology has the above advantages, since a packet filter firewall only checks and filters on a network layer, but does not parse and detect the content of an application layer of a packet, some threats from the application layer, such as a user login attack in an FTP application and so on, can be hardly prevented.